CN103685323B - A kind of Smart Home safe network implementation method based on intelligent cloud television gateway - Google Patents

Abstract

A kind of Smart Home safe network implementation method based on intelligent cloud television gateway, wherein Smart Home internal network refers to the intelligent cloud television gateway as user's Smart Home, mutual with the equipment being in household internal, and the network environment that household internal equipment is formed, also referred to as Smart Home Intranet can be controlled.Intelligent cloud television refers to obtain device certificate based on PKI digital certificate system and can provide the secure storage areas of safe read-write and with ZigBee radio communication suspension member, the uniform outlet communicated public network as Smart Home, also referred to as intelligent cloud television gateway.Portable UKey refers to have equipment room intercommunication module and the equipment of safety caculation module.Intelligent home device refers to integrated ZigBee radio communication suspension member, has detection, controls, processes the home equipment of the functions such as data.Wherein ZigBee radio communication suspension member refers to the pluggable module providing ZigBee communication and safety to calculate.The present invention has an advantage that safety is high, confidentiality is strong, and versatility and user experience good.

Description

A kind of Smart Home safe network implementation method based on intelligent cloud television gateway

Technical field

The invention belongs to Smart Home internal network security field, be specifically related to a kind of intelligence based on intelligent cloud television gateway Can house security networking implementation method.

Background technology

Along with Internet of Things, the integration of three networks, the deep development of cloud computing generation information technology, the intellectuality of terminal unit, Networking becomes the major trend of electron trade development, is expected to drive the upgrading of conventional industries.Intelligent cloud television is traditional tv With the fusant of emerging technology, as a kind of safe and reliable information carrier, on audio-visual quality, not only obtain huge changing Entering and improve, and user can be allowed to live and become more intelligent, therefore, it is the heaviest that intelligent cloud television will become each family life The ingredient wanted.Intelligent cloud television has the features such as intellectuality, platform immobilization and large screen display, can be as Smart Home Home gateway and Smart Home controllable device perfect adaptation, the secure interactive with public network carries out information, thoroughly realize family Intelligent management and control, solves user simultaneously and service provider is distrusted problem (the most each user access to home intelligent equipment The intelligent cloud television gateway controlling all to meet at oneself processes), bring high-quality home services to enjoy for user.But, faced by This emerging intelligent equipment of intelligent cloud television, relevant research institution and business organization also do not have clear and definite proposition relatively reasonable Perfect scheme solves intelligent cloud television and realizes controlling safely home equipment to access as wired home control gateway；With In the Smart Home internal network design of Shi Chuantong, the simple Zigbee protocol of general employing carries out group-net communication between home equipment, Carrying out networking only with this agreement and there is safety issue, the intelligent home device such as user can be by the household net of other families Pass is controlled, home gateway networking exists illegality equipment access, the data message of transmission can be trapped acquisition etc..In recent years, one A little enterprises have started to explore and realize home equipment networking under anthropic factor control, to meet user to Smart Home safety Demand, and obtain certain achievement, but the most it is not fully solved this problem.

Summary of the invention

The technology of the present invention solves problem: overcome the deficiencies in the prior art, it is provided that a kind of intelligence based on intelligent cloud television gateway Can house security networking implementation method, there is the advantage that safety is high, confidentiality is strong, and versatility and user experience good.

The technology of the present invention solution: a kind of Smart Home safe network implementation method based on intelligent cloud television gateway, Wherein Smart Home internal network refers to the intelligent cloud television gateway as user's Smart Home, hands over the equipment being in household internal Mutually, and the network environment that household internal equipment is formed can be controlled, also referred to as Smart Home Intranet.Intelligent cloud television refers to obtain Device certificate based on PKI digital certificate system and the secure storage areas of safe read-write can be provided and with ZigBee radio communication Suspension member, uniform outlet public network communicated as Smart Home, also referred to as intelligent cloud television gateway.Portable UKey refers to a kind of logical Cross USB(USB) be directly connected with the Micro-USB mouth of intelligent movable equipment, have cryptographic authorization functions, Reliable small memory device at a high speed, i.e. has setting of equipment room intercommunication module and safety caculation module (such as safety chip) Standby.Intelligent home device refers to integrated ZigBee radio communication suspension member, has detection, controls, processes the household of the functions such as data Equipment.Wherein ZigBee radio communication suspension member refers to the pluggable mould providing ZigBee communication and safety to calculate (such as safety chip) Block.

Briefly introducing the basic thought of this programme, the present invention has drawn the advantage of existing solution, specifically, and this Bright technical scheme includes following several aspect:

Aspect one: in view of user wants oneself home equipment of Remote Visit and Control, " the key opening door need to be provided the user Spoon ", by intelligent cloud television gateway, UKey is initialized, make UKey obtain demarcation UKey identity based on PKI Certification system Digital certificate, " key " (safety that intelligent cloud television gateway is signed and issued enter license ticket) of opening door and intelligent cloud television net The PKI closed and mark, thus set up user and access the safe and orderly mechanism of permitting the entrance of oneself Smart Home, become Smart Home Have secure access to important safe barrier.

Aspect two: realize the initialization to intelligent home device by obtaining digital certificate UKey, make Smart Home set The standby PKI obtaining the intelligent cloud television gateway being responsible for credible networking voucher and the guarantee mesh information confidentiality signed and issued by UKey, For strengthening safety based on the protocol devices networking of traditional Z igBee, reliability has established solid foundation, it is ensured that networking household The legitimacy of equipment.

Aspect three: in order to avoid illegal home equipment accesses the intelligent cloud television gateway of user, steal subscriber household secret Information, credible networking voucher that intelligent home device is issued by UKey and intelligent cloud television gateway PKI, it is achieved with intelligent cloud The mutual trust checking networking of TV gateway, and consult to obtain the symmetrical key of secure communication with intelligent cloud television gateway, build intelligence Energy cloud TV gateway receives safety permission mechanism and the Intranet house security communication mechanism of intelligent home device.

Aspect four: the key that communicates consulted with intelligent home device by intelligent cloud television gateway, it is achieved the safety of both sides Communication, prevents go-between from illegally obtaining family's private data, it is ensured that the confidentiality of family data information, integrity, carries further Rise the safety of the total system of Smart Home.

The present invention compared with prior art, has a following remarkable advantage:

User experience is good, versatility, safety height, confidentiality are strong.Owing to present invention employs safe and portable UKey's Enforcement pattern, has fabulous user operability, is applicable to general intelligent home device；Use based on PKI public simultaneously The two-layer voucher technology of key cryptosystem and symmetrical key coded communication technology, have extremely strong confidentiality, the anti-property denied, therefore User experience is good, versatility, safety height, confidentiality are strong.

Accompanying drawing explanation

Fig. 1 present invention implements overall framework；

Fig. 2 intelligent cloud television gateway initializes the flow chart of UKey；

Fig. 3 UKey initializes the flow chart of intelligent home device；

Fig. 4 intelligent cloud television gateway verifies the flow chart of networking with intelligent home device mutual trust；

Fig. 5 intelligent cloud television gateway and the flow chart of intelligent home device secure communication.

Detailed description of the invention

The present invention is by intelligent cloud television and portable safety UKey equipment, on traditional Z igBee protocol basis, uses Two-layer voucher based on PKI public key cryptography system and symmetrical key communication encryption, set up Smart Home internal network security service Mechanism.This programme passes through two-layer voucher technology based on PKI public key cryptography system, it is achieved user's intelligent home device and oneself intelligence Communicate between the identity map binding of energy cloud TV gateway and consulting device key, it is ensured that the intelligent home device of user can only be by certainly The intelligent cloud television gateway institute management and control of family, improves the personal secrets of subscriber household equipment；Simultaneously by symmetrical key coded communication Information, it is ensured that transmit the confidentiality of data, integrity between household equipment, promotes the safety coefficient of intelligent domestic system.Its core It is the security service mechanism setting up Smart Home internal network, forms the Smart Home that secure and trusted is controlled, promote Smart Home The sound development of industry.

For making the purpose of the present invention, advantage and technical scheme clearer, by implementing in detail below, and combine Accompanying drawing 1, the present invention is described in more detail.

Fig. 1 being described on the whole to the General Implementing framework of the program, in short, one is that user uses first UKey(UKey of the present invention refers to a kind of by USB(USB) the direct and Micro-USB mouth of intelligent movable equipment Be connected, have the storage device of cryptographic authorization functions) time, UKey need to be inserted in the ZigBee channel radio of intelligent cloud television gateway TV On letter suspension member interface, by the Smart Home App client certificate Cert of UKey solidification_App, checking TV pre-installs the legal of App Credible.If after App checking is credible, App starts PIN(full name Personal Identification Number, is called for short PIN, It is exactly the individual recognition code of UKey) interface is set, after user successfully arranges the PIN code of UKey, UKey generates the public and private of self , TV is signed and issued the security credence Ticket that enters by key_UKey, TV generate outbound communication key K_OutNet, the PKI K of TV_TV(pub)And mark ID_TV, intelligent cloud television gateway obtains the PKI K of UKey simultaneously_UKey(pub)With mark ID_UKey, thus complete the initialization to UKey Work；Two is that user uses UKey insertion intelligent home device D, intelligent home device D can obtain intelligent cloud television net from UKey The PKI K closed_TV(pub)With mark ID_TVAnd obtain the credible networking voucher Ticket signed and issued by UKey_D, thus complete intelligence man Occupy the initial work of equipment；Three is after user intelligent home device D completes initial work, according to credible networking voucher Ticket_DWith intelligent cloud television gateway PKI K_TV(pub), autonomously carry out and intelligent cloud television gateway secure and trusted networking and negotiation The communication encryption key of both sidesRealize user's intelligent home device to tie up with oneself identity map of intelligent cloud television gateway Fixed；Four is that user's intelligent cloud television gateway is by communication encryption keyRealize the security control of intelligent home device and Ensure the confidentiality of intelligent home device transmission information.Mainly include following tetrameric content.

One, intelligent cloud television gateway initializes the implementation method of UKey

User wants oneself home equipment of Remote Visit and Control, need to provide the user " key " opening door, pass through intelligence The UKey that user is carried with by energy cloud TV gateway initializes, and UKey can be made to obtain the license ticket Ticket that enters_UKeyAnd be The initialization of intelligent home device lays the foundation, below in conjunction with the accompanying drawings its execution process of 2 specific descriptions:

(1), when user uses UKey first, the ZigBee radio communication that UKey be inserted in intelligent cloud television gateway TV is hung On part interface, by the Smart Home App client certificate Cert of UKey solidification_App, checking TV pre-installs the legal credible of App Property (this legitimate verification principle is), after App checking is credible, UKey and intelligent cloud television gateway TV set up safety by App Trusting relationship；

(2) UKey and intelligent cloud television gateway TV are successfully established safe trusting relationship, the Smart Home App client on TV Ejecting PIN code and arrange interface, after user successfully arranges PIN code, UKey obtains PIN code by App, and then UKey generates public and private key To K_UKey(pub)And K_UKey(pri)；

(3) UKey is by self identification ID_UKeyWith PKI K_UKey(pub)Send intelligent cloud television gateway TV to；

(4) intelligent cloud television gateway TV receives UKey and identifies ID_UKeyWith PKI K_UKey(pub)After, generate time stamp T S_TVWith Outbound communication key K_OutNet, use hash algorithm (such as SHA1, SHA256) to calculate ID_TV、ID_UKeyAnd TS_TVCryptographic Hash H= Hash(ID_TV||ID_UKey||TS_TV), use intelligent cloud television gateway TV private key K_TV(pri)Cryptographic Hash H is encrypted by private key, forms intelligence Can cloud TV gateway TV signature $S_{\mathrm{TV}}=\mathrm{Sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{TV}}\right|\left|{\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{TS}}_{\mathrm{TV}}\right)\right]}_{K_{\mathrm{TV}\left(\mathrm{pri}\right)}};$

(5) intelligent cloud television gateway TV uses its PKI K_TV(pub)UKey is identified ID_UKeyWith time stamp T S_TVEncryption, shape TV is become to use its K_TV(pub)The identification information ciphertext of encryption

(6) intelligent cloud television gateway TV will be signed S_TVWith identification information ciphertextAs entering License ticket ${\mathrm{Ticket}}_{\mathrm{UKey}}=\mathrm{Sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{TV}}\right|\left|{\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{TS}}_{\mathrm{TV}}\right)\right]}_{K_{\mathrm{TV}\left(\mathrm{pri}\right)}}\left|\right|\mathrm{Enc}{\left[{\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{TS}}_{\mathrm{TV}}\right]}_{K_{\mathrm{TV}\left(\mathrm{pub}\right)}},$ To enter License ticket Ticket_UKey, TV PKI K_TV(pub), outbound communication key K_OutNetIt is handed down to UKey, simultaneously by the mark of UKey ID_UKeyWith PKI K_TV(pub)The secure storage areas of TV it is stored in as the important record of UKey；

(7) UKey accepts TV transmission information, uses and obtains PIN code to its private key K_UKey(pri)With outbound communication key K_OutNet It is encrypted protection respectively, forms private key ciphertext Enc [K_UKey(pri)]_PINWith outbound communication key ciphertext Enc [K_OutNet]_PIN；

(8) UKey passes through self identification ID_UKeyWith other hardware informations (such as memory block capacity and computing chip mark etc.), Generate PIN code protection key K_UKey(EncPin)(this key dynamic operation in UKey produces and does not preserves, and enhances the peace of UKey Full property), and by this key K_UKey(EncPin)Encryption PIN code, forms PIN code ciphertext

(9) UKey will enter license ticket Ticket_UKey, TV PKI K_TV(pub), PIN code ciphertext Outbound communication key ciphertext Enc [K_OutNet]_PIN, own public key K_UKey(pub)With private key ciphertext Enc [K_UKey(pri)]_PINAs important Record storage, the initial work of UKey completes.

The successful realization of this process, sets up user and accesses the safe and orderly mechanism of permitting the entrance of oneself Smart Home, become intelligence Important safe barrier can be accessed by house security.

Two, UKey initializes the implementation method of intelligent home device

During intelligent home device networking, intelligent home device D to be ensured can only be by oneself intelligent cloud television net of user Close TV to be identified, to guarantee that this process is safe and reliable simultaneously, use UKey that the initialization of intelligent home device is come here Meet above-mentioned security requirement, user use initial after UKey insert intelligent home device D, intelligent home device D can be from UKey obtains the PKI K of intelligent cloud television_TV(pub)With the credible networking voucher Ticket signed and issued by UKey_D, below in conjunction with the accompanying drawings 3 Specifically describe its execution process:

(1) UKey after initial is inserted on the ZigBee radio communication suspension member interface of intelligent home device D by user, intelligence After home equipment D identifies UKey, by mark ID of himself_DSend UKey to；

(2) UKey receives mark ID of home equipment D_D, generate random number N_UKey, use hash algorithm (as SHA1, SHA256) ID is calculated_D、ID_UKeyAnd N_UKeyCryptographic Hash H=Hash (ID_UKey||ID_D||N_UKey)；

(3) UKey passes through self identification ID_UKeyWith other hardware informations (such as memory block capacity and computing chip mark etc.), Generate PIN code protection key K_UKey(EncPin), and by this key K_UKey(EncPin)The PIN code ciphertext of deciphering UKey storage $\mathrm{Enc}{\left[\mathrm{PIN}\right]}_{K_{\mathrm{UKey}\left(\mathrm{EncPin}\right)}},$ Obtain PIN code；

(4) UKey obtains, by PIN code deciphering, the UKey private key K protected by PIN code in memory block_UKey(pri), and with obtaining private key K_UKey(pri)(2) step cryptographic Hash is encrypted, forms UKey signature $S_{\mathrm{UKey}}=\mathrm{Sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{ID}}_D\right|\left|N_{\mathrm{UKey}}\right)\right]}_{K_{\mathrm{UKey}\left(\mathrm{pri}\right)}};$

(5) UKey uses the PKI K of intelligent cloud television gateway_TV(pub)To device identification ID_DAnd random number N_UKeyEncryption, shape UKey is become to use K_TV(pub)The identification information ciphertext of encryption

(6) UKey will sign S_UKey, identification information ciphertextWith the license ticket Ticket that enters_UKey, As networking voucher ${\mathrm{Ticket}}_D=\mathrm{Sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{ID}}_D\right|\left|N_{\mathrm{UKey}}\right)\right]}_{K_{\mathrm{UKey}\left(\mathrm{pri}\right)}}\left|\right|\mathrm{Enc}{\left[{\mathrm{ID}}_D\right|\left|N_{\mathrm{UKey}}\right]}_{K_{\mathrm{TV}\left(\mathrm{pub}\right)}}\left|\right|{\mathrm{Ticket}}_{\mathrm{UKey}}$ It is handed down to intelligent home device D, intelligent home device D by this credible networking voucher Ticket_DStorage, intelligent home device D's Initial work completes.

The successful realization of this process, for strengthening safety based on the protocol devices networking of traditional Z igBee, reliability is established Solid foundation, it is ensured that the legitimacy of networking home equipment.

Three, the implementation method of networking is verified in intelligent cloud television gateway and intelligent home device mutual trust

After intelligent home device D has initialized, main by achieved with believable networking voucher Ticket_DAnd intelligent cloud TV gateway PKI K_TV(pub), independently carry out secure and trusted networking with intelligent cloud television gateway and consult the communication encryption of both sides KeyRealize the identity map binding of user's intelligent home device and oneself intelligent cloud television gateway, below in conjunction with the accompanying drawings Its execution process of 4 specific descriptions:

(1), after intelligent home device D has initialized, generate random number N D, use this random number N_DTo device identification ID_D With equipment network voucher Ticket_DEncryption, forms networking voucher ciphertextThen intelligence is used Cloud TV gateway PKI K_TV(pub)To N_DEncryption, forms random number ciphertextFinally by random number ciphertext Subsidiary networking voucher ciphertext is as equipment network broadcast messagePass through The ZigBee communication module of intelligent home device D is broadcasted；

(2), after intelligent cloud television gateway TV receives the mesh information of intelligent home device D broadcast, its private key is used K_TV(pri)Decrypted random number ciphertext, it is thus achieved that random number N_D, then use N_DDeciphering networking voucher ciphertext, it is thus achieved that device identification ID_DWith Equipment network voucher Ticket_D, finally checking networking voucher Ticket_DLegitimacy, intelligent cloud television gateway use UKey PKI K_UKey(pub)The signature of checking UKeyObtain cryptographic Hash H=Hash (ID_UKey||ID_D||N_UKey), and with intelligent cloud television gateway private key K_TV(pri)Deciphering is used K by UKey_TV(pub)The mark letter of encryption Breath ciphertextObtain device identification ID_DThe random number N generated with UKey_UKey, and pacify from it Full storage obtains UKey and identifies ID_UKey, use the hash algorithm (such as SHA1, SHA256) identical with UKey signature to calculate ID_D、 N_UKeyAnd ID_UKeyCryptographic Hash H₁=Hash (ID_UKey||ID_D||N_UKey), compare cryptographic Hash H and H₁It is the most equal, if both are not Identical, then show that UKey is abnormal, networking voucher Ticket_DIllegal, TV stops next step work；If both are identical, then Showing that UKey is normal, TV uses its PKI K_TV(pub)Checking signatureObtain Obtain cryptographic Hash H=Hash (ID_TV||ID_UKey||TS_TV), and with its private key K_TV(pri)Deciphering is by K_TV(pub)The identification information of encryption is close Literary compositionObtain UKey and identify ID_UKeyTime stamp T S generated with TV_TV, use and sign with TV Identical hash algorithm (such as SHA1, SHA256) calculates ID_TV、ID_UKeyAnd TS_TVCryptographic Hash H₁=Hash (ID_TV||ID_UKey|| TS_TV), compare cryptographic Hash H and H₁The most equal, if both differ, then show that TV signature is forged, networking voucher Ticket_D Illegal, TV stops next step work；If both are identical, then show that TV is normal, networking voucher Ticket_DChecking legitimacy, Then equipment D information is shown the networking equipment list in intelligent cloud television gateway；If other legal intelligence in subscriber household Home equipment D^·After receiving intelligent home device D broadcast message, broadcast will be forwarded based on Zigbee protocol as routing node This information；If intelligent home device D illegal in user's wired home^×After receiving intelligent home device D broadcast message, nothing Method obtains by N_DThe particular content of encryption data and initiate man-in-the-middle attack to TV；If intelligent cloud television gateway requires networking tool Standby high security and ageing, can control to verify networking voucher Ticket_DNumber of times and time stamp T S of this voucher_TVRealize, I.e. equipment network voucher Ticket_DIn N_DHaving uniqueness, the proving time of networking voucher not can exceed that and opens from timestamp simultaneously The certain time begun；

(3) during user selects intelligent cloud television gateway TV, a certain equipment D(in home equipment networking list such as adds behaviour Make), intelligent cloud television gateway is that this equipment D randomly generates Traffic encryption key(TEK)And by mark ID of equipment_D, networking with Card Ticket_DAnd Traffic encryption key(TEK)It is stored in its secure storage areas as an equipment record；

(4) intelligent cloud television gateway uses (2) step to obtain random number N_D+ 1 couple of device identification ID_DAnd Traffic encryption key(TEK)Encryption, forms communication key ciphertextThis ciphertext attendant equipment is identified ID_DPass through Its ZigBee communication module is broadcasted；

(5), after intelligent home device D receives TV broadcast data, its (1) step is used to generate random number N_D+ 1 deciphering is logical Letter key ciphertext obtains mark ID of equipment_DWith communication encryption keyChecking receives device identification and deciphering acquisition sets The concordance of standby mark, if both verify unanimously, then by communication encryption keyNetworking voucher Ticket_D, intelligent cloud electricity View closes PKI K_TV(pub)Preserve as a record；If both verify inconsistent, then intelligent home device D repeats (1) Step, if perform M(M >=1) secondary, it is thus achieved that mark ID_DMark ID is obtained with deciphering_DStill consistent, then quit work.If user After intelligent home device D legal in family receives TV broadcast message, by based on ZigBee(low speed short-distance transmission wireless Procotol, low-power consumption the territory fidonetFido of IEEE802.15.4 standard) agreement as routing node, forward and broadcast this information； If intelligent home device D illegal in subscriber household^×After receiving TV broadcast message, it is impossible to obtain by N_DThe tool of encryption data Internal appearance, then initiate man-in-the-middle attack to intelligent home device D.

The successful execution of this process, intelligent home device and intelligent cloud television gateway complete mutual trust checking networking and consult double The symmetrical key of side's secure communication, builds intelligent cloud television gateway and receives safety permission mechanism and the Intranet of intelligent home device House security communication mechanism.

Four, intelligent cloud television gateway and the implementation method of intelligent home device secure communication

After intelligent cloud television gateway receives the remote control commands to intelligent home device D, use the outer net that it stores Communication key K_OutNet(this K_OutNetWith UKey one_to_one corresponding) deciphering this equipment control instruction of acquisition, then led to by this equipment D Letter encryption keyComplete and the safe access control of information between intelligent home device, 5 specifically describe it below in conjunction with the accompanying drawings Execution process:

(1) intelligent cloud television gateway TV receive intelligent home device D remote control commands (this instruction format:UKey in intelligent cloud television gateway secure storage areas is used to identify ID_UKeyCorresponding Outbound communication key K_OutNetCiphertext is instructedIt is decrypted, obtains the mark of this equipment ID_DWith control instruction cmd；

(2) Traffic encryption key(TEK) corresponding for home equipment D during Intelligent television terminal gateway TV uses its secure storage areas To device identification ID_DEncrypt with control instruction cmd, form the instruction of equipment D Intranet control extensionWill The Intranet control extension instruction attendant equipment mark ID generated_D, should by the ZigBee-network module of intelligent cloud television gateway Control information $<<{\mathrm{ID}}_D\left|\right|\mathrm{Enc}{\left[{\mathrm{ID}}_D\right|\left|\mathrm{cmd}\right]}_{K_{D_{\mathrm{InNet}}}}>>$ Broadcast；

(3) after intelligent home device D receives the information of intelligent cloud television gateway TV broadcast, the communication encryption stored with it KeyControl extension is instructedIt is decrypted, it is thus achieved that control command cmd and mark ID_D, checking Obtain mark ID_DThe most consistent with self identification, if checking is consistent, then home equipment D performs this control command cmd and obtains this life After these data data of data data(after the execution of order comprise the exectorial state of home equipment or home equipment execution order Acquisition information, such as intelligent electric lamp on off state, the humiture value information of intelligent temperature and humidity equipment)；If verifying inconsistent, then household Equipment D does not do any operation.After if intelligent home device D legal in subscriber household receives TV broadcast message, will be based on Zigbee protocol, as routing node, forwards and broadcasts this information；If intelligent home device D illegal in subscriber household^×Receive After TV broadcast message, it is impossible to obtain the particular content of encrypted instruction and initiate man-in-the-middle attack to D；

(4) intelligent home device D will instruct successful execution and obtain data Data and intelligent home device D mark ID_D, use intelligence Can home equipment D communication encryption keyEncryption, forms encryption dataD will encrypt number According to subsidiary its mark ID_DAs returning dataEntered by the ZigBee communication module of D Row broadcast；

(5) intelligent cloud television gateway TV receives the return data of D broadcast After, utilize and obtain device identification ID_DSearch Traffic encryption key(TEK) corresponding for home equipment D in secure storage areasAnd useDeciphering encryption dataObtain the device identification ID of encryption_DWith execution data data, test Mark ID that card directly obtains_DMark ID is obtained with deciphering_DThe most consistent, if checking is consistent, then use UKey mark in (1) step Know ID_UKeyCorresponding outbound communication key K_OutNetTo mark ID_DEncrypt with data data, form outer net encryption and perform resultAnd outer net encryption is performed result subsidiary UKey mark ID_UKeyAs partial data recordIt is sent to remote control terminal；If verifying inconsistent, then intelligent cloud television gateway weight Multiple perform (2) step, if performing M(M >=1) secondary, it is thus achieved that mark ID_DMark ID is obtained with deciphering_DStill consistent, then return execution Remote control terminal is given in failure.If other legal intelligent home device D in subscriber household^·Receive intelligent home device D wide After broadcasting information, then by wireless network protocol based on ZigBee(low speed short-distance transmission, the low-power consumption of IEEE802.15.4 standard Individual territory fidonetFido) agreement as routing node, forward and broadcast this information；If intelligent home device D illegal in subscriber household^× After receiving intelligent home device D broadcast message, it is impossible to obtain the particular content of encrypted data, then initiate go-between to TV and attack Hit.

The successful execution of this process, it is achieved the secure communication of Smart Home Intranet, prevents go-between from illegally obtaining family hidden Private data are launched a offensive, it is ensured that the confidentiality of family data information, integrity, promote the total system of Smart Home further Safety.

Non-elaborated part of the present invention belongs to techniques well known.

The above, part detailed description of the invention the most of the present invention, but protection scope of the present invention is not limited thereto, and appoints How those skilled in the art are in the technical scope that the invention discloses, the change that can readily occur in or replacement all should be contained Within protection scope of the present invention.

Claims (6)

1. a Smart Home safe network implementation method based on intelligent cloud television gateway, it is characterised in that realize step such as Under:

(1), when user uses UKey first, the ZigBee radio communication suspension member that UKey need to be inserted in intelligent cloud television gateway TV connects On mouth, by the Smart Home App client certificate Cert of UKey solidification_App, checking TV pre-installs the legal credibility of App；Institute State UKey refer to a kind of to be directly connected with the Micro-USB mouth of intelligent movable equipment by USB USB, have close The storage device of code authentication function；If after App checking is credible, App starts the individual recognition code PIN of UKey and arranges interface, uses After family successfully arranges the PIN code of UKey, UKey generates the public private key pair of self, TV signs and issues the security credence Ticket that enters_UKey、TV Generate outbound communication key K_OutNet, the PKI K of TV_TV(pub)Mark ID with TV_TV, intelligent cloud television gateway TV obtains simultaneously The PKI K of UKey_UKey(pub)Mark ID with UKey_UKey, thus complete the initial work to UKey；

(2) user uses UKey to insert intelligent home device D, intelligent home device D and obtains intelligent cloud television gateway from UKey PKI K_TV(pub)Mark ID with intelligent cloud television gateway_TVAnd obtain the credible networking voucher Ticket signed and issued by UKey_D, thus Complete the initial work to intelligent home device；

(3) after user's intelligent home device D completes initial work, according to credible networking voucher Ticket_DWith intelligent cloud television net Close PKI K_TV(pub), autonomously carry out and intelligent cloud television gateway secure and trusted networking and the communication encryption key of negotiation both sidesRealize the identity map binding of user intelligent home device D and oneself intelligent cloud television gateway TV；

(4) user's intelligent cloud television gateway TV passes through communication encryption keyRealize the security control to intelligent home device D And ensure the confidentiality of intelligent home device transmission information.

Smart Home safe network implementation method based on intelligent cloud television gateway the most according to claim 1, its feature It is: the initial work of the UKey in described step (1) is implemented as follows:

(1), when user uses UKey first, the ZigBee radio communication suspension member that UKey be inserted in intelligent cloud television gateway TV connects On mouth, by the Smart Home App client certificate Cert of UKey solidification_App, checking TV pre-installs the legal credibility of App, After App checking is credible, UKey and intelligent cloud television gateway TV set up safe trusting relationship by App；

(2) UKey and intelligent cloud television gateway TV are successfully established safe trusting relationship, and the Smart Home App client on TV ejects PIN code arranges interface, and after user successfully arranges PIN code, UKey obtains PIN code by App, and then UKey generates public private key pair K_UKey(pub)And K_UKey(pri)；

(3) UKey is by mark ID of self_UKeyWith PKI K_UKey(pub)Send intelligent cloud television gateway TV to；

(4) intelligent cloud television gateway TV receives UKey and identifies ID_UKeyWith PKI K_UKey(pub)After, generate time stamp T S_TVAnd outer net Communication key K_OutNet, use hash algorithm to calculate ID_TV、ID_UKeyAnd TS_TVCryptographic Hash H=Hash (ID_TV||ID_UKey|| TS_TV), use intelligent cloud television gateway TV private key K_TV(pri)Cryptographic Hash H is encrypted by private key, forms intelligent cloud television gateway TV signature

(5) intelligent cloud television gateway TV uses its PKI K_TV(pub)Mark ID to UKey_UKeyWith time stamp T S_TVEncryption, forms TV Use its K_TV(pub)The identification information ciphertext of encryption

(6) intelligent cloud television gateway TV will be signed S_TVWith identification information ciphertextAs license of entering VoucherAnd will enter perhaps Can voucher Ticket_UKey, TV PKI K_TV(pub), outbound communication key K_OutNetBeing handed down to UKey, TV is by the mark of UKey simultaneously ID_UKeyWith PKI K_TV(pub)The secure storage areas of TV it is stored in as the important record of UKey；

(7) UKey accepts TV transmission information, uses and obtains PIN code to its private key K_UKey(pri)With outbound communication key K_OutNetRespectively It is encrypted protection, forms private key ciphertext Enc [K_UKey(pri)]_PINWith outbound communication key ciphertext Enc [K_OutNet]_PIN；

(8) UKey passes through self identification ID_UKeyAnd other hardware informations including memory block capacity and computing chip identify, Generate PIN code protection key K_UKey(EncPin), and by this key K_UKey(EncPin)Encryption PIN code, forms PIN code ciphertext

(9) UKey will enter license ticket Ticket_UKey, TV PKI K_TV(pub), PIN code ciphertextOuter net Communication key ciphertext Enc [K_OutNet]_PIN, own public key K_UKey(pub)With private key ciphertext Enc [K_UKey(pri)]_PINAs important record Storage, the initial work of UKey completes.

Smart Home safe network implementation method based on intelligent cloud television gateway the most according to claim 1, its feature It is: in described step (2), the initial work of intelligent home device is implemented as follows:

(1) UKey after initial is inserted on the ZigBee radio communication suspension member interface of intelligent home device D by user, Smart Home After equipment D identifies UKey, by mark ID of himself_DSend UKey to；

(2) UKey receives mark ID of home equipment D_D, generate random number N_UKey, use hash algorithm to calculate ID_D、ID_UKeyWith N_UKeyCryptographic Hash H=Hash (ID_UKey||ID_D||N_UKey)；

(3) UKey mark ID by self_UKeyAnd other hardware letter including memory block capacity and computing chip identify Breath, generates PIN code protection key K_UKey(EncPin), and by this key K_UKey(EncPin)The PIN code ciphertext of deciphering UKey storageObtain PIN code；

(4) UKey obtains, by PIN code deciphering, the UKey private key K protected by PIN code in memory block_UKey(pri), and with obtaining private key K_UKey(pri)(2) step cryptographic Hash is encrypted, forms UKey signature

(5) UKey uses the PKI K of intelligent cloud television gateway_TV(pub)To device identification ID_DAnd random number N_UKeyEncryption, is formed UKey uses K_TV(pub)The identification information ciphertext of encryption

(6) UKey will sign S_UKey, identification information ciphertextWith the license ticket Ticket that enters_UKey, make For networking voucher It is handed down to intelligent home device D, intelligent home device D by this credible networking voucher Ticket_DStorage, intelligent home device D's Initial work completes.

Smart Home safe network implementation method based on intelligent cloud television gateway the most according to claim 1, its feature It is: the user's intelligent home device in described step (3) is concrete real with the identity map binding of oneself intelligent cloud television gateway As follows:

(1), after intelligent home device D has initialized, random number N is generated_D, use this random number N_DTo device identification ID_DWith set Standby networking voucher Ticket_DEncryption, forms networking voucher ciphertextThen intelligent cloud electricity is used View closes PKI K_TV(pub)To N_DEncryption, forms random number ciphertextFinally that random number ciphertext is subsidiary Networking voucher ciphertext is as equipment network broadcast messageBy intelligence The ZigBee communication module of home equipment D is broadcasted；

(2), after intelligent cloud television gateway TV receives the mesh information of intelligent home device D broadcast, its private key K is used_TV(pri)Solve Close random number ciphertext, it is thus achieved that random number N_D, then use N_DDeciphering networking voucher ciphertext, it is thus achieved that device identification ID_DAnd equipment network Voucher Ticket_D, finally checking networking voucher Ticket_DLegitimacy, intelligent cloud television gateway TV use UKey PKI K_UKey(pub)The signature of checking UKeyObtain cryptographic Hash H=Hash (ID_UKey||ID_D||N_UKey), and with intelligent cloud television gateway private key K_TV(pri)Deciphering is used K by UKey_TV(pub)The mark letter of encryption Breath ciphertextObtain device identification ID_DThe random number N generated with UKey_UKey, and pacify from it Full storage obtains UKey and identifies ID_UKey, use the hash algorithm identical with UKey signature to calculate ID_D、N_UKeyAnd ID_UKeyKazakhstan Uncommon value H₁=Hash (ID_UKey||ID_D||N_UKey), compare cryptographic Hash H and H₁The most equal, if both differ, then show UKey Abnormal, networking voucher Ticket_DIllegal, TV stops next step work；If both are identical, then show that UKey is normal, intelligence Its PKI K can be used by cloud TV gateway TV_TV(pub)Checking signatureObtain Cryptographic Hash H=Hash (ID_TV||ID_UKey||TS_TV), and with its private key K_TV(pri)Deciphering is by K_TV(pub)The identification information ciphertext of encryptionObtain UKey and identify ID_UKeyTime stamp T S generated with TV_TV, use and TV signature phase Same hash algorithm calculates ID_TV、ID_UKeyAnd TS_TVCryptographic Hash H₁=Hash (ID_TV||ID_UKey||TS_TV), compare cryptographic Hash H and H₁The most equal, if both differ, then show that TV signature is forged, networking voucher Ticket_DIllegal, TV stops next step Work；If both are identical, then show that TV is normal, networking voucher Ticket_DChecking legitimacy, then believe intelligent home device D Breath display is in the networking equipment list of intelligent cloud television gateway；If other legal intelligent home device D in subscriber household^·Connect After receiving intelligent home device D broadcast message, will forward broadcast this information based on Zigbee protocol as routing node；If Intelligent home device D illegal in subscriber household^×After receiving intelligent home device D broadcast message, then cannot obtain by N_DAdd The particular content of ciphertext data and initiate man-in-the-middle attack to TV；If intelligent cloud television gateway require networking possess high security and Ageing, then can control to verify networking voucher Ticket_DNumber of times and time stamp T S of this voucher_TVRealize, i.e. equipment network Voucher Ticket_DIn N_DHaving uniqueness, the proving time of networking voucher not can exceed that the timing started from timestamp simultaneously Between；

(3) a certain intelligent home device D in home equipment networking list, intelligent cloud during user selects intelligent cloud television gateway TV TV gateway is that this intelligent home device D randomly generates Traffic encryption key(TEK)And by mark ID of equipment_D, networking voucher Ticket_DAnd Traffic encryption key(TEK)It is stored in intelligent cloud television gateway TV secure storage areas as an equipment record；

(4) intelligent cloud television gateway uses (2) step to obtain random number N_D+ 1 couple of device identification ID_DAnd Traffic encryption key(TEK) Encryption, forms communication key ciphertextThis ciphertext attendant equipment is identified ID_DBy it ZigBee communication module is broadcasted；

(5), after intelligent home device D receives TV broadcast data, (1) step is used to generate random number N_D+ 1 deciphering communication key is close Mark ID of literary composition acquisition equipment_DWith communication encryption keyChecking receives device identification and deciphering obtains device identification Concordance, if both verify unanimously, then by communication encryption keyNetworking voucher Ticket_D, intelligent cloud television gateway PKI K_TV(pub)Preserve as a record；If both verify inconsistent, then intelligent home device D repeats (1) step, if performing M (M >=1) is secondary, it is thus achieved that mark ID_DMark ID is obtained with deciphering_DStill consistent, then quit work；If it is legal in subscriber household After intelligent home device D receives TV broadcast message, then will forward broadcast this letter based on Zigbee protocol as routing node Breath；If intelligent home device D illegal in subscriber household^×After receiving TV broadcast message, it is impossible to obtain by N_DEncryption data Particular content, then to intelligent home device D initiate man-in-the-middle attack.

Smart Home safe network implementation method based on intelligent cloud television gateway the most according to claim 1, its feature It is: described step is implemented as follows in (4):

(1) intelligent cloud television gateway TV receives the remote control commands of intelligent home device D, this instruction format:UKey in intelligent cloud television gateway secure storage areas is used to identify ID_UKeyCorresponding Outbound communication key K_OutNetCiphertext is instructedIt is decrypted, obtains this intelligent home device Mark ID_DWith control instruction cmd；

(2) Traffic encryption key(TEK) corresponding for intelligent home device D during Intelligent television terminal gateway TV uses its secure storage areasTo device identification ID_DEncrypt with control instruction cmd, form the instruction of intelligent home device D Intranet control extensionThe Intranet control extension instruction attendant equipment mark ID that will generate_D, by intelligent cloud television gateway ZigBee-network module is by this control informationBroadcast；

(3) after intelligent home device D receives the information of intelligent cloud television gateway TV broadcast, the communication encryption key stored with itControl extension is instructedIt is decrypted, it is thus achieved that control command cmd and mark ID_D, checking obtains Mark ID_DThe most consistent with self identification, if checking is consistent, then intelligent home device D performs this control command cmd and obtains this life Data data after the execution of order, after these data data comprise the exectorial state of home equipment or home equipment execution order Acquisition information, including intelligent electric lamp on off state, the humiture value information of intelligent temperature and humidity equipment；If verifying inconsistent, then intelligence Can not do any operation by home equipment D；If after intelligent home device D legal in subscriber household receives TV broadcast message, Then will forward broadcast this information based on Zigbee protocol as routing node；If Smart Home illegal in subscriber household sets Standby D^×After receiving TV broadcast message, it is impossible to obtain the particular content of encrypted instruction, then in the middle of intelligent home device D initiates People attacks；

(4) intelligent home device D will instruct successful execution and obtain data Data and intelligent home device D mark ID_D, with intelligence man Occupy equipment D communication encryption keyEncryption, forms encryption dataIntelligent home device D By subsidiary for encryption data its mark ID_DAs returning dataLed to by the ZigBee of D Letter module is broadcasted；

(5) intelligent cloud television gateway TV receives the return data of intelligent home device D broadcast After, utilize and obtain device identification ID_DSearch Traffic encryption key(TEK) corresponding for intelligent home device D in secure storage areasAnd WithDeciphering encryption dataObtain the device identification ID of encryption_DWith perform data data, Mark ID that checking directly obtains_DMark ID is obtained with deciphering_DThe most consistent, if checking is consistent, then use UKey in (1) step Mark ID_UKeyCorresponding outbound communication key K_OutNetTo mark ID_DEncrypt with data data, form outer net encryption and perform resultAnd outer net encryption is performed result subsidiary UKey mark ID_UKeyAs partial data recordIt is sent to remote control terminal；If verifying inconsistent, then intelligent cloud television gateway weight Multiple perform (2) step, if it is secondary to perform M (M >=1), it is thus achieved that mark ID_DMark ID is obtained with deciphering_DStill consistent, then return execution Remote control terminal is given in failure；If other legal intelligent home device D in subscriber household^·Receive intelligent home device D wide After broadcasting information, then will forward broadcast this information based on Zigbee protocol as routing node；If intelligence illegal in subscriber household Can home equipment D^×After receiving intelligent home device D broadcast message, then cannot obtain the particular content of encrypted data to TV Initiate man-in-the-middle attack.

Smart Home safe network implementation method based on intelligent cloud television gateway the most according to claim 2, its feature It is: PIN code protection key K of the generation in described step (8)_UKey(EncPin)In UKey, dynamic operation produces and does not preserves, Enhance the safety of UKey.